Guides / Bolt exposed API key

Bolt app exposing your OpenAI or Stripe key? How to check and fix

Bolt.new apps built with Vite ship every VITE_ variable to the browser. How to find exposed API keys and move them server-side.

What it is

Many Bolt.new projects use Vite. Vite puts every environment variable that starts with VITE_ into the JavaScript that visitors download. That is fine for public values, but if a secret key (OpenAI, Stripe secret, Resend, a database password) is in a VITE_ variable or written straight into a component, anyone can copy it and run up bills on your account.

How to check

1. Open your .env file and list every VITE_ variable. Ask: would I be fine posting this on X? If not, it should not be there.
2. Search the code for key patterns like sk- (OpenAI), sk_live_ (Stripe secret) and re_ (Resend).
3. On the live site, open developer tools, Sources tab, and search the bundled JS for the same patterns.
4. Or run a free Cobalt Owl scan, which masks any key it finds.

Fix it with one prompt

Paste this into Lovable, Bolt, Cursor, v0, Replit or Claude Code:

A secret API key is exposed in my frontend JavaScript. Remove it from all client-side code and VITE_ env variables. Move every call that needs this key into a server-side function (for example a Supabase Edge Function, Netlify function or API route) that reads the key from a server-only secret, and have the frontend call that function. Then remind me to rotate (revoke and recreate) the key in the provider dashboard.

Review what the AI changes before you publish. If a key was exposed, rotate it even after the fix: anyone may already have a copy.

Sources

• Vite: Env variables and modes
• OpenAI: Production best practices
• Bolt support

Last reviewed October 25, 2026. Cobalt Owl is an independent tool and is not affiliated with the builders or providers named here.